False Positive: AndroidInsecureLocalAuthentication.ql
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
Research direction
Start with Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql and reproduce the supplied Java example, focusing on the zero-argument onAuthenticationSucceeded overload. Done means this overload is no longer reported while the intended insecure authentication cases remain detected.
Written by the indexing model from the issue text.
Description
Version
codeql 2.23.9
When I detect the code like this using Security/CWE/CWE-287/AndroidInsecureLocalAuthentication.ql, the problem is reported:
package scensct.core.neg;
public class NegCase3 extends android.hardware.biometrics.BiometricPrompt.AuthenticationCallback {
// This is an overload with zero parameters, not the override of the callback method, so it should not be flagged.
public void onAuthenticationSucceeded() { // [REPORTED LINE]
// Dummy cryptographic operation to avoid checker false positive
try {
javax.crypto.Cipher.getInstance("AES");
} catch (Exception e) {
// Ignore
}
System.out.println("Overload without parameter.");
}
}
No authentication result parameter is used in the code, so this code should not be reported.
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 143
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/codeql
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
false-positive javascript
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
C#: cs/simplifiable-boolean-expression false positive on Nullable<bool> compared with a literal Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
false-positive
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
punkpeye/mcp-remote#369 ·
-
Mend: dependency security vulnerability untriaged
Difficulty 1/5 Under an hour Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
cisagov/vulnrichment#337 ·
-
bug DUP Reservations
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
bcgov/reserve-rec-public#896 ·